Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Auditing Differential Privacy in the Black-Box Setting

Kaining Shi, Cong Ma

TL;DR

This work addresses auditing differential privacy in black-box settings by framing it as a hypothesis test under $f$-differential privacy, where a trade-off function $T(P,Q)$ characterizes the hardness of distinguishing outputs from neighboring datasets. It introduces CIPA, a conformal-inference–based auditing mechanism that reliably controls the Type I error in finite samples and explores the fundamental impossibility of achieving small Type II error without extra assumptions. Under a monotone likelihood ratio (MLR) condition, the authors show simultaneous control of both error types and extend the method to construct finite-sample confidence bands for the privacy trade-off function, including a lower-bound impossibility for distribution-free lower bands. The results provide practical, non-asymptotic tools for verifying privacy guarantees in proprietary DP mechanisms and clarify when stronger distributional assumptions are required for reliable auditing.

Abstract

This paper introduces a novel theoretical framework for auditing differential privacy (DP) in a black-box setting. Leveraging the concept of $f$-differential privacy, we explicitly define type I and type II errors and propose an auditing mechanism based on conformal inference. Our approach robustly controls the type I error rate under minimal assumptions. Furthermore, we establish a fundamental impossibility result, demonstrating the inherent difficulty of simultaneously controlling both type I and type II errors without additional assumptions. Nevertheless, under a monotone likelihood ratio (MLR) assumption, our auditing mechanism effectively controls both errors. We also extend our method to construct valid confidence bands for the trade-off function in the finite-sample regime.

Auditing Differential Privacy in the Black-Box Setting

TL;DR

This work addresses auditing differential privacy in black-box settings by framing it as a hypothesis test under -differential privacy, where a trade-off function characterizes the hardness of distinguishing outputs from neighboring datasets. It introduces CIPA, a conformal-inference–based auditing mechanism that reliably controls the Type I error in finite samples and explores the fundamental impossibility of achieving small Type II error without extra assumptions. Under a monotone likelihood ratio (MLR) condition, the authors show simultaneous control of both error types and extend the method to construct finite-sample confidence bands for the privacy trade-off function, including a lower-bound impossibility for distribution-free lower bands. The results provide practical, non-asymptotic tools for verifying privacy guarantees in proprietary DP mechanisms and clarify when stronger distributional assumptions are required for reliable auditing.

Abstract

This paper introduces a novel theoretical framework for auditing differential privacy (DP) in a black-box setting. Leveraging the concept of -differential privacy, we explicitly define type I and type II errors and propose an auditing mechanism based on conformal inference. Our approach robustly controls the type I error rate under minimal assumptions. Furthermore, we establish a fundamental impossibility result, demonstrating the inherent difficulty of simultaneously controlling both type I and type II errors without additional assumptions. Nevertheless, under a monotone likelihood ratio (MLR) assumption, our auditing mechanism effectively controls both errors. We also extend our method to construct valid confidence bands for the trade-off function in the finite-sample regime.

Paper Structure

This paper contains 16 sections, 8 theorems, 41 equations, 2 algorithms.

Table of Contents

  1. Introduction
  2. Main contributions.
  3. Related work
  4. Background and Problem Formulation
  5. f-Differential Privacy
  6. Black-Box Auditing Point Differential Privacy
  7. A Conformal Inference-Based DP Auditing Mechanism
  8. Small Type II error is Impossible in the Distribution-Free Setting
  9. Small Type II Error under MLR Assumption
  10. Constructing Confidence Bands for the Trade-Off Function
  11. Conclusions and discussions
  12. Proof of Theorem \ref{['theorem-typeI']}
  13. Proof of Theorem \ref{['theorem-Impossibility']}
  14. Proof of Theorem \ref{['theorem-typeII']}
  15. Proof of Theorem \ref{['theorem-CI']} and Theorem \ref{['theorem-asymtotic convergence']}
  16. ...and 1 more sections

Key Result

Theorem 1

Let Algorithm algorithm1 run with any specified $\alpha \in(0,1)$. Without any further assumptions about the distributions $P$ and $P'$, Algorithm algorithm1 guarantees the type I error for point DP testing does not exceed $\alpha$, formally:

Theorems & Definitions (20)

  • Definition 1: Trade-off Function, GDP
  • Definition 2: $f$-Differential Privacy, GDP
  • Definition 3: Point $f$-Differential Privacy
  • Definition 4: Auditing Mechanism
  • Definition 5: Type I and Type II Errors
  • Theorem 1
  • Example 1
  • Theorem 2
  • Remark 1
  • Theorem 3
  • ...and 10 more